Langflow vulnerabilities
We track 115 vulnerabilities in Langflow products. 115 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 8, 2026.
Latest Langflow vulnerabilities
- 9.9 Critical severity
Langflow OSS: Deserialization of Untrusted Data
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation,
- 8.8 High severity
Langflow OSS: Improper Control of Generation of Code
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the `apply_tweaks()` function.
- 8.1 High severity
Langflow OSS: Improper Limitation of a Pathname to a Restricted Directory
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.
- 8.8 High severity
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to…
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files.
- 8.8 High severity
Langflow OSS: Improper Limitation of a Pathname to a Restricted Directory
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename="../../../target/path" ), enabling arbitrary fi
- 8.8 High severity
Langflow OSS: Improper Neutralization of Special Elements used in an OS Command
IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.
- 9.8 Critical severity
Langflow OSS: Incomplete List of Disallowed Inputs
IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate
- 9.9 Critical severity
Langflow OSS: Improper Control of Generation of Code
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false secur
- 9.8 Critical severity
Langflow OSS: Missing Authentication for Critical Functionality
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication whe
- 9.8 Critical severity
Langflow OSS: Missing Authentication for Critical Functionality
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate t
- 9.8 Critical severity
IBM Langflow Code Injection Exploited
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
- 9.1 Critical severity
Langflow OSS: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest.
- 9.9 Critical severity
Langflow OSS: Improper Control of Generation of Code
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.
- 9.8 Critical severity
Langflow OSS: Deserialization of Untrusted Data
IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity.
- 9.8 Critical severity
IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper…
IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.
- 9.8 Critical severity
Langflow OSS: Incorrect Authorization
IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.
- 8.2 High severity
Langflow OSS: Server-Side Request Forgery
IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in ver
- 9.1 Critical severity
Langflow OSS: Improper Authentication
IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information d
- 9.6 Critical severity
Langflow OSS: Authorization Bypass Through User-Controlled Key
IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using in
- 10.0 Critical severity
Langflow OSS: Improper Control of Generation of Code
IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abus
- 8.5 High severity
Langflow OSS: Server-Side Request Forgery
IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role) can bypass SSRF protections by enabling the
- 9.8 Critical severity
Langflow OSS: Improper Authentication
IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.
- 10.0 Critical severity
Langflow OSS: Improper Control of Generation of Code
IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compro
- 8.1 High severity
Langflow OSS: Authorization Bypass Through User-Controlled Key
IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.
- 8.1 High severity
Langflow OSS: Authorization Bypass Through User-Controlled Key
IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to other users, and to delete persisted vertex build data for another user's flow.
- 8.8 High severity
Langflow Desktop: Deserialization of Untrusted Data
IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.
- 7.5 High severity
Langflow: Deserialization of Untrusted Data
Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is required to exploit this vulnerability. The
- 7.1 High severity
Langflow: Improper Control of Generation of Code
Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration o
- 9.8 Critical severity
Langflow Inclusion of Functionality from Untrusted Control Sphere Exploited
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to ex
- 9.8 Critical severity
Langflow: Improper Neutralization of Directives in Dynamically Evaluated Code
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. Th
- 9.8 Critical severity
Langflow: Improper Control of Generation of Code
Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists
- 8.8 High severity
Langflow Origin Validation Error Exploited
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie co
- 9.8 Critical severity
Langflow: Improper Control of Generation of Code
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.
- 8.8 High severity
Langflow: Improper Control of Dynamically-Managed Code Resources
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.
- 9.8 Critical severity
langflow: Improper Control of Generation of Code
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.